Mac users interested in Ftk imager mac gui generally download: MacOSXForensics Imager 1.1 Free This application will allow you to make bit for bit images of physical devices and store the result image file in the Encase (Expert Witness) or FTK format.
![]() ![]()
Computer ForensicsA community dedicated towards the branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime. The field is the application of several information security principles and aims to provide for attribution and event reconstruction following forth from audit processes. This subreddit is not limited to just the computers and encompasses all media that may also fall under digital forensics (e.g., cellphones, video, etc.). Topics include digital forensics, incident response, malware analysis, and more.Vote based on the quality of the content. Irrelvant submissions will be pruned in an effort towards tidiness. Read the before posting.Related Subreddits:- anti forensics- cryptography- forensics- cyberlaws- malware- memory forensics- netsec- binary reversing- reversing/malware researchRelated Technical Subreddits- filesystems- kernel development- low level programming.
What we did was to take a previous e01 image of a Mac, restore it to an external USB drive, configure it as our own forensic version and then use that drive to boot the computer by holding down the option key.Have your forensic tools like FTK imager for Mac GUI version preloaded on it and create your e01 directly to it. FTK Imager for Mac defaults to imaging the Internal drive.FYI, be careful, there are Macbook Pros out there that have M2 type SSDs and ALSO a 500gb or 1TB sata data drive. If you are not careful you can open it up and only see the data drive.
![]() Comments are closed.
|
AuthorWrite something about yourself. No need to be fancy, just an overview. Archives
January 2023
Categories |